- cypherpunks-legacy - lists.cpunks.org

Warning: Don't run MacPGP 2.6 on a 68000 based Macintosh
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Warning. MacPGP 2.6 (1.1.1) will *not* work on a 68000 based Macintosh. It will bomb. I was unaware of the nasty hack you have to do when compiling MacPGP in order to get it to be 68000 aware. People who have the source distribution can compile it for either machine. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAgUBLfupN1UFZvpNDE7hAQHY7QH5AWxYbjgSGhV45R6MTWQ43HytC7ZdlPdQ E9dCNnmKK2NvPdJOOq/ZLEbSE0jjmcMzKDT3crL5yulYTAAcgfojFQ== =IVv2 -----END PGP SIGNATURE-----

1 0

Re: back to programming projects...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > On a related note, should encrypting remailers have the keys changed > > regularly? The RSA-IDEA combination isn't very suspectible to known > > plaintext attacks, right? Right. There are two sets of encryption used in the RSA-IDEA combo: 1) RSA, encrypting a random session key with a public-key algorithm. By definition, RSA-like public key algorithms can easily have known or chosen plaintext generated, since you can encrypt anything you like. RSA isn't susceptible to known-plaintext (except for verifying that a (presumably stolen) private key is correct, or by factoring very large numbers of very large prime numbers and checking them, which is computationally infeasible), and any other public key system that *were* susceptible to known-plaintext attacks wouldn't be very useful. Major breakthroughs in factoring theory could always change this, earning mathematical fame and fortune for the discoverer. Short RSA keys can be factored; you're better off with 1024-bit keys or longer for anything you're real serious about. 2) IDEA, encrypting the message itself using the session key. IDEA is not known to be susceptible to anything better than brute force, so known-plaintext attacks require trying 2**128 keys, which is computationally infeasible. Perhaps someone can find a hole in IDEA, but there's nothing major at present. 3) There's a third component that might use encryption - generating the "random" session key. Obviously, if you use the same session key to send different messages to different people, they might notice. If you use different session keys to send messages to people, but the session keys are easily derived from each other, and one recipient notices the pattern from several messages sent to him, he might try guessing the key for the next messages you send to other people. So use a genuine high-quality random number generator. There is one more special case, which is sending the same message to multiple recipients, with the message encrypted once with the session key, and multiple versions of the session key encrypted with each different recipient's public key. I've forgotten the details, but if there are more than e recipients, it's possible to crack this. (e is the encryption exponent, typically 3 or 17.) That's why PGP and other well-designed systems will pad the session key with random stuff before encrypting with RSA (which is an essentially free operation, since the RSA blocksize is much larger than the session key for IDEA.) Bill

1 0

Re: Protocol Wanted!
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> How does Bob make Alice aware that he can factor RSA keys > and make sure that he and Alice can do business without > either one of them getting ripped off or the NSA catching him. Sounds like a job for Blacknet, or similar anonymous-broadcast systems. He can't easily hide the fact that *somebody* is in the business from the NSA, since he can't easily tell that Alice doesn't work for the NSA and isn't planning to publish his business's existence to the net. But if he and Alice are both remailer-users able to post to the Blacknet broadcast (using whatever mechanism, like alt.waste), Bob can post a note to Alice saying he is able to crack RSA keys for money, and Alice can post replies saying she doesn't believe him and here's a message to crack. There are cut-and-choose protocols described in Schneier that can handle (awkwardly) the mechanics of getting Bob to recode and return the message, and Alice to hand over the digicash, without either of them feeling too ripped off, assuming there's a digicash system in place that gives sufficient anonymity. Bob has a bit of an advantage in convincing Alice, since he can probably read her encrypted posts to the net - he can start teh conversation by posting to her on Blacknet with some keywords from messages she's posted to other people. That doesn't directly tell her that he's cracking RSA rather than IDEA/3DES, but he could also include a note that the first n bits of her private key are ....... Alternatively, he can go on a political rant about Too Many Secrets, but having seen that movie he can announce the details of his decryptor on sci.crypt *before* announcing that he's giving a lecture at Stanford... :-) Somebody, in the discussion about pricing, said that some of the proposed protocols would take too much CPU time, cracking lots of keys just to demonstrate that he can do it, and that he should always charge money to avoid overloading his 486 box. If he's going to go into the business of factoring RSA keys for money, he'll probably make enough to afford a few *new* computers once he hits up a couple of wealthy customers, if he's not spending it all on air travel and bodyguards. "Bob"

1 0

Friends in high places
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Friday, I got a message from Intergraph's chief counsel. "Great," I thought. "I'm about to get my peepee whacked for making PGP available over our internal software delivery network." Nope. He wanted to discuss the finer points of its use. He'd read the documentation and the _WSJ_ article about Zimmermann. He believes e-mail isn't secure enough for his purposes but that PGP will make it usable for him. Where'd he get the software? From one of the 4 executive vice-presidents here. Where'd he get it? No word yet, but I think I know :) It speaks well of our efforts that executives at a Fortune 400 firm are not only aware of PGP but that they approve its use. Keep up the evangelism. Keep talking to people. Keep answering questions. Keep writing code. If we build it, they will come. - -Paul - -- Paul Robichaux, KD4JZG | Catch the wave with Mosaic for CLIX! perobich(a)ingr.com | newprod -n newprod(a)poboy.b17c.ingr.com Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfxbH6fb4pLe9tolAQH2SQQAl6/PWNY2b19qOVsWn75eG6mRoYYNcZL2 gD28z7eIYlehtKMPH7AdZvPG8X8nj3WQXIid1yWkeT+Hccp3gNNRIfXPwV/ZO3m9 kxuf0NiNo7j8hkFPDVMubeqRASJyMRi3fufyV9jMrvktjd8J/r/8rG21No27zrhP nsklqVfatk0= =XGl2 -----END PGP SIGNATURE-----

1 0

Re: back to programming projects...
by Jim choate 17 Dec '03

17 Dec '03

> > Hmmm - looks like you need a mechanism for setting up keys other than > for registered users - after all, one thing they will presumably want > to do is send anonymous mail to other remailers, with the mail > to those systems going out encrypted. > > Bill > What I envision here is that the user will have to setup the keys for the various accounts on other re-mailers. The only other option I have is to make a header switch such that the outgoing is clear-text. I am not shure if I want to support this feature or not. What I had intended was to build it to support person to person transmissions w/ the anon built in to make traffic analysis by address harder. I will have to look at chaining. Thanks for the input...

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

dfloyd(a)runner.utsa.edu (Douglas R. Floyd) writes: > How rude is it for people to post (or mail to a mailing list) anon messages > encrypted with someone's PGP key? It makes it easy for the receiver to > obtain it, but how irritating is it to people? Fairly. In fact, it's considered downright rude. It's like sitting around a table of, say, 3 people, and whispering with someone next to you. The first person is you -- you're sending the message. The second person is your friend -- he's recieving it. The third is me -- I'm just watching two people whispering. Further, newsgroups are a very inappropriate place to send private mail for propogation. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Crytography - Solution (long) (fwd)
by Jim choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Test; please ignore
by whitaker＠dpair.csd.sgi.com 17 Dec '03

17 Dec '03

Test; please ignore TEST Mon Jun 13 12:58:52 PDT 1994 -- Russell Earl Whitaker whitaker(a)csd.sgi.com Silicon Graphics Inc. Technical Assistance Center / Centre D'Assistance Technique / Tekunikaru Ashisutansu Sentaa Mountain View CA (415) 390-2250 ================================================================ #include <std_disclaimer.h>

1 0

URGENT Action required (NJ folks only) (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message:

1 0

UPDATE 2: Crypto export campaign - more fax numbers
by Stanton McCandlish 17 Dec '03

17 Dec '03

YOUR letters, faxes and calls are needed now to ensure that the cryptography, privacy and security provisions of the Cantwell Export Administration Act are preserved in bill HR3837 - help strike a blow against Clipper and for freely distributable software like PGP and RIPEM. If you can't fax directly, you can send your message to glickman(a)eff.org. EFF will fax or hand-deliver it for you to the Committee Chair, Rep. Dan Glickman. Updates on the Fax numbers of the House Intelligence Committee. Subcommittee fax: +1 202 225 1991 Sometimes does not answer. Keep trying! it IS a working fax number. Rep phone fax D KS Glickman, Daniel +1 202 225 6216 +1 202 225 5398 Chair Rep. Glickman's staff has finally released his fax number. D TX Coleman, Ronald D. +1 202 225 4831 +1 202 225 4831 This fax number is also a voice line. Staff manually switch to fax if they hear fax tones. You may wish to call by voice to make sure they do this if your fax attempts fail. If you don't get thru, call the Committee, and ask for the voice number, it may have been changed. D AL Cramer Jr, Robert (Bud) +1 202 225 4801 +1 202 225 4392 Rep. Cramer's staff has finally released his fax number. D MO Gephardt, Richard A. +1 202 225 2671 +1 202 225 7414 Rep. Gephardt has changed his fax number. The correct one is given here. R NE Bereuter, Douglas +1 202 225 4806 +1 202 226 1148 Sometimes does not answer. This IS a valid fax #, keep trying. R CA Dornan, Robert K. +1 202 225 2965 Rep. Dornan has disconnected this fax number. His office does have a fax, but it has been made non-public. Constituents may wish to describe to Rep. Dornan how they feel about such manouvers. R IL Michel, Robert H. +1 202 225 6201 +1 202 225 9249 Try again if you don't get an answer. This is a working fax number. Many thanks to Janet E. Harrison <tat(a)well.sf.ca.us> for doing the footwork for this update. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0